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UNITED STATES DISTRICT COURT 
FOR THE DISTRICT OF COLUMBIA 
UNITED STATES OF AMERICA 
V. Criminal Case No. 21-582 (CRC) 
MICHAEL A. SUSSMANN, 
Defendant. 
GOVERNMENT’S OPPOSITION TO DEFENDANT’S MOTION TO EXCLUDE THE 
GOVERNMENT’S PROPOSED EXPERT WITNESS TESTIMONY 

The United States of America, by and through its attorney, Special Counsel John H. 
Durham, respectfully submits this opposition to the defendant’s Motion to Exclude the 
Government’s Proposed Expert Witness Testimony (Document 66, hereinafter “Mot.”). For 
reasons stated below, the government submits that the motion should be denied. 

FACTUAL BACKGROUND 

The defendant is charged in a one-count indictment with making a materially false statement 
to an FBI official, in violation of Title 18, United States Code, Section 1001. As set forth in the 
Indictment, on Sept. 19, 2016 — less than two months before the 2016 U.S. Presidential election — 
the defendant, a lawyer at a large international law firm (“Law Firm-1”’), met with the FBI General 
Counsel at FBI Headquarters in Washington, D.C. The defendant had requested the meeting to 
provide the General Counsel with purported data and “white papers” that allegedly demonstrated a 
covert communications channel between the Trump Organization and a Russia-based bank 
(“Russian Bank-1”’). In the course of the meeting, the defendant lied, falsely stating to the General 


Counsel that he was not providing the allegations to the FBI on behalf of any client. This false 
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representation led the General Counsel to understand that the defendant was providing the 
information as a good citizen, rather than a paid advocate or political operative. In fact, the 
defendant had assembled and conveyed the allegations to the FBI on behalf of at least two specific 
clients, including a technology executive (“Tech Executive-1”) at a U.S.-based Internet company 
(“Internet Company-1”) and the Hillary Rodham Clinton Presidential Campaign (the “Clinton 
Campaign’). 

The Indictment alleges that, beginning in approximately July 2016, Tech Executive-1 had 
worked with the defendant, a U.S. investigative firm retained by Law Firm-1 on behalf of the 
Clinton Campaign (the “U.S. Investigative Firm”), numerous cyber researchers, and employees at 
multiple Internet companies to assemble the purported data and white papers. In connection with 
these efforts, Tech Executive-1 exploited his access to non-public and/or proprietary Internet data. 
Tech Executive-1 also enlisted the assistance of researchers at a U.S.-based university (“University- 
1”) who were receiving and analyzing large amounts of Internet data in connection with a pending 
federal government cybersecurity research contract. 

The Government’s evidence at trial will establish that among the Internet data Tech 
Executive-1 and his associates exploited was domain name system (“DNS”) Internet traffic 
pertaining to (1) a particular healthcare provider (“Healthcare Company-1”), (ii) Trump Tower, (iii) 
Donald Trump’s Central Park West apartment building, and (iv) the Executive Office of the 
President of the United States (“EOP”). 

The Indictment further alleges that on February 9, 2017, the defendant provided an updated 
set of allegations — including the Russian Bank-1 data and additional allegations relating to Trump 


— to a second agency of the U.S. government (“Agency-2”). The Government’s evidence at trial 
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will establish that these additional allegations relied, in part, on the purported DNS traffic that Tech 
Executive-1 and others had assembled pertaining to Trump Tower, the EOP, and Healthcare 
Company-1. In his meeting with Agency-2, the defendant provided data which he claimed reflected 
purportedly suspicious DNS lookups by these entities of internet protocol (“IP”) addresses affiliated 
with a Russian mobile phone provider (“Russian Phone Provider-1”). The defendant further 
claimed that these lookups demonstrated that Trump and/or his associates were using a type of 
Russian-made wireless phone in the vicinity of the White House and other locations. 

On March 30, 2022, the Government disclosed to the defense, pursuant to Federal Rule of 
Criminal Procedure 16(a)(1)(G), notice of its intention to call an expert witness to testify regarding 
DNS data and other matters relevant to cyber investigations. More specifically, the Government 
disclosed that Special Agent David Martin, an FBI Unit Chief who is assigned to the FBI’s Cyber 
Division, Technical Analysis Unit, would testify regarding the following: 

e A description to the jury about the basic mechanics, architecture, and terminology of the 

DNS system and DNS data so that the jury can understand the various technical terms 
and concepts which appear in documents and other evidence that the Government 
intends to offer; 

e An explanation to the jury regarding how certain private companies and entities 
maintain DNS “resolvers” and provide services involving DNS data, which includes 
processing and storing DNS data; 

e A description of how private companies and entities gain access to DNS data and how 


they collect and commercialize that data; 
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e An explanation of certain examples of DNS data to assist the jury in understanding 
particular fields that appear within the data; 
e A description to the jury concerning the types of conclusions that can be drawn about 
(i) online activities based on a review of DNS data, and (ii) the origins and sources of 
DNS data; and 
e Anexplanation to the jury regarding the Onion Router (“TOR”) and common terms used 
in connection with TOR, including the concept of a “TOR exit node” and the types of 
investigative steps and methods used for analyzing online activities involving TOR. 
Additionally, the Government provided notice that it would call an expert witness in a 
rebuttal case, or otherwise, should the defense — through cross examination of Government 
witnesses or testimony of its own witnesses — suggest, imply, or seek to prove the authenticity of 
the relevant DNS data or the truth of the allegations concerning a covert communications channel 
between the Trump Organization and Russian Bank-1. 
ARGUMENT 
The defendant argues that the Court should preclude the Government from offering expert 
testimony because the Government’s expert notice was untimely, deficient, and the proposed 
testimony is irrelevant and prejudicial. Still, the defendant recognizes that the jury would be aided 
by Special Agent Martin’s testimony, but only “regarding basic, uncontroversial matters such as 
what DNS data.” Mot. at 12. The evidence in this case will be replete with concepts and 
terminology that are “outside the ken of the average person,” and therefore appropriately explained 
by an expert. United States v. Felder, 993 F.3d 57, 72 (2d Cir. 2021). As explained below, 


excluding the Government’s proposed expert is inconsistent with well-settled law, and ignores other 
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remedies, such as allowing the Government to provide a supplemental disclosure or a brief 
adjournment of trial, which would be more appropriate here based on the defendant’s claim of late 
notice. The Government has provided adequate, timely notice of its intention to call an expert 
witness and satisfied the requirements of Rule 16. Thus, for the reasons below, the Motion should 
be denied. 

A. Applicable Law 

Federal Rule of Criminal Procedure 16(a)(1)(G) provides that “[a]t the defendant's request, 
the government must give to the defendant a written summary of any [expert] testimony that the 
government intends to use ... during its case-in-chief at trial,” which must “describe the [expert] 
witness's opinions, the bases and reasons for those opinions, and the witness's qualifications.” Rule 
16(d) vests broad authority to the district court to regulate discovery and with a range of remedial 
options, which includes a continuance, exclusion of the evidence, or “any other order that is just 
under the circumstances.” Fed. R. Crim. P. 16(d)(2). 

Rule 702 of the Federal Rules of Evidence 702 governs the admissibility of expert witness 
testimony. Under Rule 702, “[a] witness . . . qualified as an expert by knowledge, skill, experience, 
training, or education may testify in the form of an opinion or otherwise if . . . the expert’s scientific, 
technical, or other specialized knowledge will help the trier of fact to understand the evidence or to 
determine a fact in issue.” Fed. R. Evid. 702. 

There are therefore two prerequisites to the admission of expert testimony: that the proffered 
testimony “be both reliable and relevant.” United States v. Nwoye, 824 F.3d 1129, 1136 (D.C. Cir. 
2016). “[T]o ensure the reliability and relevancy of expert testimony,” Kumho Tire Co., Ltd. v. 


Carmichael, 526 U.S. 137, 152 (1999), the district court has a threshold obligation to independently 
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determine to what extent a witness can testify as an expert, as well as to ensure that the expert's 
testimony stays within permissible constraints. /d. “In general, Rule 702 has been interpreted to 
favor admissibility” see, e.g., Khairkhwa v. Obama, 793 F. Supp. 2d 1, 10 (D.D.C. 2011), and 
indeed, the exclusion of expert testimony is “the exception rather than the rule.” Fed. R. Evid. 702 
advisory committee’s note. 


B. The Government Expert’s Testimony Will Aid the Jury’s Understanding of the 
Evidence 


1. The Government’s Expert Notice is Not Untimely 

The defendant first argues that the Government’s March 30, 2022 notice was untimely. As 
the defendant correctly states, Federal Rule of Criminal Procedure 16 does not contain a specific 
timing requirement. Instead, Rule 16 (a)(1)(G) “is intended to minimize surprise that often results 
from unexpected expert testimony, [to] reduce the need for continuances, and to provide the 
opponent with a fair opportunity to test the merit of the expert’s testimony through focused cross- 
examination.” Fed. R. Crim. P. 16 advisory committee’s note (1993 Amendment). 

First, the Government’s expert disclosure here was not untimely. Indeed, the D.C. Circuit 
has previously held that the Government’s expert disclosure six weeks prior to trial was timely. See 
United States v. Martinez, 476 F.3d 961, 967-68 (D.C.Cir.2007) (upholding the admission of expert 
testimony under Rule 16 where the government provided information as to the challenged testimony 
approximately six weeks before trial and in opposition to a motion to exclude the testimony). In 
contrast, in cases where courts have found that the government's notice was untimely, the disclosure 
of the expert occurred on the eve of trial. See United States v. Martinez, 657 F.3d 811, 817 (9th 
Cir.2011) (government disclosure of expert five days before trial not “timely” but district court was 
within its discretion to deny a continuance where expert's testimony was a month away); United 


6 
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States v. Hoffecker, 530 F.3d 137, 184-88 (3d Cir.2008) (defendant's disclosure of expert three 
business days before jury selection untimely); United States v. Johnson, 228 F.3d 920, 922, 926 
(8th Cir.2000) (government's disclosure of expert six days before trial in violation of district court 
order untimely). 

The cases that the defendant relies on also miss the mark. For instance, one case which the 
defendant relies on, United States v. Day, 524 F.3d 1361 (D.C. Cir. 2008), is readily distinguishable. 
There, the D.C. Circuit upheld the district court’s exclusion of the defendant’s expert witness 
because the defendant identified the expert with a “vague” two-page report less than two weeks 
before trial and after the district court had excluded the testimony of three other proposed defense 
experts. /d. at 1371-72. Similarly, in United States v. Wilson, the district court excluded the 
testimony of a defense expert when the defense had failed to provide notice of the expert until less 
than one week before trial. 493 F. Supp. 2d 484, 485-488 (E.D.N.Y. 2006). 

The defendant’s reliance on the unpublished opinion from the District of Colorado in United 
States v. Nacchio is likewise misplaced. 2010 WL 2323842 (D. Colo. Mar. 22, 2007). There the 
Government made disclosure of an expert report 25 days prior to trial which it had in draft form for 
at least a year. Jd. at *2. Of note, the court’s decision to exclude the Government’s expert, as 
opposed to granting a continuance, was based in part on the court having already reviewed jury 
questionnaires for an eight-week trial and that a continuance would require the court to “go through 
[the] entire jury questionnaire process again.” Jd. at 5. Here, there has been no such failure of 
diligence, nor has one even been alleged. Moreover, if the Court were to find that the Government’s 


notice was somehow untimely, the appropriate remedy would be a brief continuance of trial, not 
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the exclusion of highly relevant evidence which would be of assistance to the jury. Accordingly, 
the Government respectfully submits that its disclosure was timely. 

Second, the Government has gone above its Rule 16 obligations in disclosing to the defense 
that it would call an expert in rebuttal or otherwise, to testify concerning the authenticity of the 
relevant DNS data or the actual truth of the allegations at issue concerning a secret channel of 
communications between the Trump Organization and Russian Bank-1. Consistent with the plain 
language of Rule 16 and case law in other circuits, the government's presentation of rebuttal expert 
testimony without prior notice does not violate Rule 16 since the Rule's notice requirements apply 
only to the government's case-in-chief. See United States v. Windham, 489 F.2d 1389, 1392 (Sth 
Cir. 1974) (“Rebuttal witnesses are a recognized exception to all witness disclosure requirements.’’); 
see also United States v. DiCarlantonio, 870 F.2d 1058, 1063 (6th Cir.1989) (Rule 16 does not 
require disclosure of expert rebuttal testimony not offered during government's case-in-chief); 
United States v. Barrett, 766 F.2d 609, 617 (1st Cir.1985) (same); United States v. Angelini, 607 
F.2d 1305, 1308-09 (9th Cir.1979) (same). 

2. The Government’s Expert Disclosure is Adequate 

The defendant next argues that the Government’s expert disclosure is “substantively and 
materially deficient.” Mot. at 8. The defendant is mistaken. As noted above, Rule 16(a)(1)(G) 
requires the government to provide a “written summary” of the expert testimony it intends to 
introduce at trial. But a Rule 16 disclosure “is not intended to serve as the basis for a judicial 
determination regarding admissibility.” United States v. Nacchio, 519 F.3d 1140, 1151 (10th Cir. 
2018) vacated in part on reh’g en banc, 555 F.3d 1234 (10th Cir. 2019). Instead, it is “designed to 


give opposing counsel notice that expert testimony will be presented, permitting ‘more complete 
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pretrial preparation’ by the opposing side[.]” Jd. Thus, a “[d]etailed extensive discussion is not 
required in the Rule 16 summary .. . ‘[as] the requirement of setting forth the bases and reasons for 
the witnesses’ opinions does not track the methodological factors set forth by [] Daubert [].” United 
States v. McCluskey, 954 F. Supp. 2d 1224, 1231 (D.N.M. 2013) (quotation omitted). 

The Government’s disclosure meets the requirements of Rule 16 and adequately provides a 
written summary as to Special Agent Martin’s expected expert testimony. As is detailed above, 
Special Agent Martin’s expert testimony is necessary to aid the jury in understanding certain 
concepts, including the basic mechanics and terminology of the DNS system and DNS data. 
Further, the Government expects testimony from other witnesses regarding the gathering of DNS 
data by Tech Executive-1 and his associates (including his taskings of individuals at University-1 
and various internet companies). Special Agent Martin’s testimony explaining how certain 
companies gain access and provide services involving DNS data will likewise clearly assist the jury 
in understanding these issues. In addition, the Government expects to present evidence in its case- 
in-chief regarding the FBI and Agency-2’s conclusions about the Russian Bank-1 allegations, 
including the particular investigative and analytical steps taken by these agencies. Again, Special 
Agent Martin’s testimony will be helpful to the jury regarding what types of conclusions can be 
drawn about a person’s or entity’s online activities based on a review of DNS data. Ultimately, the 
Government’s disclosure satisfies Rule 16’s notice requirement and provides the defense with 
adequate information to challenge the testimony at trial. 

In addition, the Government’s disclosure of Special Agent Martin’s curriculum vitae was 
sufficient under Rule 16. In doing so, the Government provided notice of Special Agent Martin’s 


qualifications which, based on his education, training, and experience in the area of cyber 
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investigations, is adequate to meet the requirements under Rule 16. Nevertheless, the Motion 
contends that the Government’s disclosure did not provide the “bases and reasons” for Special 
Agent Martin’s opinion or how he “is qualified to testify specifically about DNS or TOR.” Mot. at 
9. To the extent that the Government’s prior disclosure did not adequately inform the defense of 
Special Agent Martin’s qualifications, the Government intends to provide defense with a 
supplemental disclosure regarding his training and experience with DNS and TOR, including the 
following: 
e As part of his cyber threat investigations, Special Agent Martin regularly analyzes 
network traffic, which includes DNS data; 
e in furtherance of his investigations, Special Agent Martin reviews DNS data 
regularly, often on a daily and/or weekly basis ; and 
e as an FBI Unit Chief, Special Agent Martin supervises analysts and other agents 
work product, which includes technical review of DNS data analysis. 
Accordingly, the Government’s notice is adequate, and any arguable deficiencies will be cured by 
the supplemental disclosure as outlined above. 
3. The Proffered Expert Testimony is Relevant and Not Prejudicial 
Finally, the defendant argues that any testimony regarding the accuracy of the data (and 
related conclusions) is irrelevant and unduly prejudicial. See Mot. at 10. That argument likewise 
should be rejected. As the Government memorialized in its expert notice to the defense, through 
discussions with defense counsel, the Government learned that the defense was inclined to not offer 
evidence, or engage in questioning, that would imply or seek to prove the authenticity of the DNS 


data provided to the FBI and Agency-2. In addition, the Government learned that the defense would 
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not engage in questioning or present evidence regarding the truth of the allegations at issue 
concerning a secret channel of communications between the Trump Organization and Russian 
Bank-1. As a result, the Government provided notice that should the defense attempt to seek to 
establish such conclusions regarding these areas through cross-examination or its own witnesses, 
that the Government reserved the right to call Special Agent Martin as an expert concerning the 
ultimate accuracy and/or reliability of the data. 

The Government’s disclosure here is entirely proper. As the Government has already 
disclosed to the defense, should the defense attempt to elicit testimony surrounding the accuracy 
and/or reliability of the data that the defendant provided to the FBI and Agency-2, Special Agent 
Martin would explain the following: 

e That while he cannot determine with certainty whether the data at issue was cherry-picked, 
manipulated, spoofed or authentic, the data was necessarily incomplete because it was a 
subset of all global DNS data; 

e That the purported data provided by the defendant nevertheless did not support the 
conclusions set forth in the primary white paper which the defendant provided to the FBI; 

e That numerous statements in the white paper were inaccurate and/or overstated; and 

e That individuals familiar with these relevant subject areas, such as DNS data and TOR, 
would know that such statements lacked support and were inaccurate and/or overstated. 

Testimony regarding these areas is highly relevant should the defense seek to argue that the 
defendant relied on Tech Executive-1’s conclusions and lacked a motive to conceal information 
about his clients. In like manner, Special Martin’s testimony regarding these areas would also be 


relevant to explain Tech Executive-1’s motive in concealing his involvement in promoting the 
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allegations concerning a secret channel of communications between the Trump Organization and 
Russian Bank-1. Ultimately, the Government should be entitled to introduce Special Agent 
Martin’s testimony either in its case-in-chief or in rebuttal, as appropriate, should the defense 
attempt to elicit testimony surrounding the accuracy and/or reliability of the data. 
CONCLUSION 
For the foregoing reasons, the Court should deny the defendant’s Motion to Exclude the 


Government’s Proposed Expert Witness Testimony. 


Respectfully submitted, 


JOHN H. DURHAM 
Special Counsel 


By: 


/s/ 

Jonathan E. Algor 
Assistant Special Counsel 
jonathan.algor@usdoj.gov 


Andrew J. DeFilippis 
Assistant Special Counsel 
andrew.defilippis@usdoj.gov 


Michael T. Keilty 
Assistant Special Counsel 
michael.keilty@usdoj.gov 


Brittain Shaw 


Assistant Special Counsel 
deborah.b.shaw@usdoj.gov 
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